WHAT IS CLAIMED IS: 

1 . A method of delivering a network service, the method comprising: 
receiving a data packet, the data packet including a service address and a payload; 
identifying a plurality of network applications associated with the service address of the data 

packet, the plurality of network applications associated with the service address including 
a first network application, a second network application, and a third network application; 

sending at least the payload of the data packet to the first network application; 

sending at least the payload of the data packet to the second network application; 

receiving a second network application response packet from the second network application; 
and 

sending a third network application packet to the third network application, the third network 
application packet based at least in part on the second network application response 
packet. 

2. The method of claim 1 , wherein: 

receiving a data packet includes receiving a data packet via a first network interface; 
sending at least the payload of the data packet to the first network application includes 

sending at least the payload of the data packet to the first network application via a 

second network interface, the second network interface being different than the first 

network interface; and 
sending at least the payload of the data packet to the second network application includes 

sending at least the payload of the data packet to the second network application via the 

second network interface. 
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3 . The method of claim 1 , further comprising: 

receiving a third network application response packet from the third network application; and 
sending a service response packet to a source address of the data packet, the service response 
packet based at least in part on the third network application response packet. 

4. The method of claim 1 , further comprising: 

receiving a first network application response from the first network application; 
identifying the second network application based at least in part on the first network 

application response; and 
sending at least a portion of the first network application response to the second network 

application. 

5. The method of claim 2, further comprising: 

receiving a first network application response from the first network application on the 

second network interface; 
identifying the second network application based at least in part on the first network 

application response and the second network interface; and 
sending at least a portion of the first network application response to the second network 

application. 

6. The method of claim 2, wherein sending at least the payload of the data packet to the first 
network application includes: 

identifying the first network application based at least in part on the service address of the 
data packet and the first network interface; and 



80 



SNI-101C 



sending at least the payload of the data packet to the first network application via a second 
network interface. 



7. The method of claim 1 , wherein: 

the first network application has a first network application address and the second network 

application has a second network application address; 
sending at least the payload of the data packet to the first network application includes 

identifying the first network application address based at least in part on the service 

address; and 

sending at least the payload of the data packet to the second network application includes 
identifying the second network application address based at least in part on the service 
address. 

8. The method of claim 7, wherein: 

the data packet includes a service port identifier; 

sending at least the payload of the data packet to the first network application includes 
identifying the first network application address based at least in part on the service port 
identifier; and 

sending at least the payload of the data packet to the second network application includes 
identifying the second network application address based at least in part on the service 
port identifier. 

9. The method of claim 2, wherein: 

the first network application has a first network application address and the second network 
application has a second network application address; 
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sending at least the payload of the data packet to the first network application includes 

identifying the first network application address based at least in part on the service 

address and the first network interface; and 
sending at least the payload of the data packet to the second network application includes 

identifying the second network application address based at least in part on the service 

address and the first network interface. 

10. The method of claim 9, wherein: 

the data packet includes a service port identifier; 

sending at least the payload of the data packet to the first network application includes 
identifying the first network application address based at least in part on the service port 
identifier; and 

sending at least the payload of the data packet to the second network application includes 
identifying the second network application address based at least in part on the service 
port identifier. 

1 1 . The method of claim 9, wherein: 

the second network application response packet includes a second network application 

response source address; 
the third network application has a third network application address; and 
sending a third network application packet to the third network application includes 

identifying the third network application address based at least in part on the second 

network application response source address. 
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12. The method of claim 11, wherein the first network application address is different from 
the first network application response source address. 

13. The method of claim 1 1 , wherein the first network application address is the same as the 
first network application response source address. 

14. The method of claim 2, wherein: 

receiving a second network application response packet from the second network application 
includes receiving the second network application response packet from a third network 
interface, the third network interface being different from the second network interface 
and the first network interface; and 

sending a third network application packet to the third network application includes sending 
the third network application packet to the third network application via a fourth network 
interface, the fourth network interface being different from the third network interface, 
the second network interface, and the first network interface. 

1 5 . The method of claim 1 4, further comprising: 

receiving a third network application response packet from the third network application via 

the fourth network interface; 
sending a second network application return packet to the second network application via the 

third network interface, the second network application return packet based at least in 

part on the third network application response packet; 
receiving a second network application return response packet from the second network 

application via the second network interface; and 
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sending a service response packet via the first network interface, the service response packet 
based at least in part on the second network application return response packet. 

16. The method of claim 15, further comprising: 

sending a first network application return packet to the first network application via the 
second network interface, the first network application return packet based at least in part 
on the second network application return response packet. 

17. The method of claim 1, wherein: 

sending at least the payload of the data packet to the first network application is based at least 
in part on a stateless identification of the first network application; 

sending at least the payload of the data packet to the second network application is based at 
least in part on a stateless identification of the second network application; and 

sending the third network application packet to the third network application is based at least 
in part on a stateless identification of the third network application. 
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18. The method of claim 1, wherein the first network application is different from the second 
network application, the second network application is different from the third network 
application, and the first network application is different from the third network application. 

1 9. The method of claim 18, wherein the first network application is a first version of a 
network application and the second network application is a second version of the network 
application. 

20. The method of claim 19, wherein the first version of the network application is from a 
first vendor, the second version of the network application is from a second vendor, and the first 
vendor is different from the second vendor. 

21 . The method of claim 1 , wherein: 

the first network application is selected from the group consisting of an intrusion detection 
application, a virus detection application, a firewall application, a web switch, a network 
security application, and a load balancing application; and 

the second network application is a different network application selected from the group 
consisting of an intrusion detection application, a virus detection application, a virtual 
private network application, a firewall application, a web switch, a network security 
application, a proxy application, a database application, and a load balancing application. 

22. The method of claim 1, further comprising: 

receiving a third network application response packet from the third network application; 
generating a service response packet as a data product, the service response packet based at 

least in part on the third network application response packet; and 
sending a service response packet to a source address of the data packet. 
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23. A method to manage delivery of a network service, the method comprising: 
receiving a data packet having a service address and a payload; 

identifying a plurality of network applications based at least in part on the service address, 

the plurality of network applications including at least a first network application, a 

second network application, and a third network application; 
distributing at least the payload of the data packet to the first network application and the 

second network application based at least in part on the service address; 
sequentially processing the data packet through at least the second network application and 

the third network application based at least in part on the service address; and 
sending a data packet service response based at least in part on the data packet sequential 

processing. ~ 

24. The method of claim 23, wherein sequentially processing the data packet through at least 
the second network application and the third network application consists essentially of 
statelessly sequentially processing the data packet through at least the second network 
application and the third network application. 

25. The method of claim 23, wherein: 

receiving a data packet having a service address and a payload includes receiving the data 
packet via a first network interface; 

distributing at least the payload of the data packet to the first network application and the 
second network application includes distributing at least the payload of the data packet to 
the first network application and the second network application via a second network 
interface, the second network interface being different from the first network interface; 
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sequentially processing the data packet through at least the second network application and 
the third network application includes sequentially processing the data packet through at 
least the second network application and the third network application via the second 
network interface and one or more additional network interfaces, the one or more 
additional network interfaces being different from the first network interface and the 
second network interface; and 

sending a data packet service response includes sending the data packet service response via 
the first network interface. 

26. The method of claim 25, wherein: 

receiving a data packet includes receiving a data packet including a service port identifier; 

distributing at least the payload of the data packet to the first network application and the 
second network application based at least in part on the service address includes 
distributing at least the payload of the data packet to the first network application and the 
second network application based at least in part on the service address and the service 
port identifier; and 

sequentially processing the data packet through at least the second network application and 
the third network application based at least in part on the service address includes 
sequentially processing the data packet through at least the second network application 
and the third network application based at least in part on the service address and the 
service port identifier. 
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27. The method of claim 26, wherein sending a data packet service response based at least in 
part on the data packet sequential processing includes generating the data packet service 
response as a data product based at least in part on the data packet sequential processing. 



28. A system to manage delivery of a network service, the system comprising: 
a first network interface to receive a data packet, the data packet including a service address; 
packet processing logic to store packet processing information, the packet processing 
information including 

a service address field to store the service address, the service address associated 
with a plurality of network applications, the plurality of network applications 
including a first network application, a second network application, and a 
third network application; 
packet distribution information including one or more packet distribution entries, 
a packet distribution entry including a source address field to store a source 
address and a destination address field to store a destination address; and 
packet sequential processing information including one or more packet 

sequencing entries, a packet sequencing entry including a source address field 
to store a source address and a destination address field to store a destination 
address; and 

a second network interface to transmit at least the payload of the data packet to the first 
network application and the second network application, the second network interface 
being different from the first network interface, the second network application being 
different from the first network application; 
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a third network interface to receive a second network application response packet, the third 
network interface being different from the second network interface and the first network 
interface; and 

a fourth network interface to send a third network application packet to the third network 
application, the third network application packet based at least in part on the second 
network application response packet, the third network application being different from 
the first network application, the fourth network interface being different from the third 
network interface, the second network interface, and the first network interface. 

29. The system of claim 28, wherein: 

a packet distribution entry of the one or more packet distribution entries includes 
a received interface field to store a received interface identifier, and 
a send interface field to store a send interface identifier; and 

a packet sequencing entry of the one or more packet sequencing entries includes 
a received interface field to store a received interface identifier; and 
a send interface field to store a send interface identifier. 

30. The system of claim 28, wherein: 

the data packet includes a first service port identifier; 

a packet distribution entry of the one or more packet distribution entries includes a service 

port field to store a service port identifier; and 
a packet sequencing entry of the one or more packet sequencing entries includes a service 

port field to store a service port identifier. 
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3 1 * The system of claim 28 , wherein: 

the data packet includes a first service port identifier; 

a packet distribution entry of the one or more packet distribution entries includes 
a received interface field to store a received interface identifier, 
a service port field to store a service port identifier 
a send interface field to store a send interface identifier, and 
a send address field to store a send address; and 

a packet sequencing entry of the one or more packet sequencing entries includes 
a received interface field to store a received interface identifier, 
a service port field to store a service port identifier, 
a send interface field to store a send interface identifier, and 
a send address field to store a send address. 
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32. The system of claim 31, wherein the send address is a network address of a network 
application system of the plurality of network application systems, 

33. The system of claim 31, wherein the send address is a media access controller address of 
a network application system of the plurality of network application systems. 

34. The system of claim 31, wherein each packet distribution entry of the plurality of packet 
distribution entries includes a destination system type field to store a destination system type 
identifier. 

35. The system of claim 28, wherein the first network application system is a first 
implementation of one network application system and the second network application system is 
a second implementation of the one network application system. 

36. The system of claim 28, further comprising a plurality of network application systems, 
one or more of the plurality of network application systems coupled to one or more of the second 
network interface, the third network interface, and the fourth network interface. 

37. The system of claim 36, wherein the plurality of network application systems include one 
or more of an intrusion detection application, a virus detection application, a virtual private 
network application, a firewall application, a web switch, a network security application, a proxy 
application, a database application, and a load balancing application. 
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38. The system of claim 28, wherein: 

the first network application system is selected from the group consisting of an intrusion 
detection application, a virus detection application, a firewall application, a web switch, a 
network security application, and a load balancing application; and 

the second network application system is a different network application selected from the 
group consisting of an intrusion detection application, a virus detection application, a 
virtual private network application, a firewall application, a web switch, a network 
security application, a proxy application, a database application, and a load balancing 
application. 
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39. The system of claim 28, wherein the data packet uses one or more protocols of one of a 
TCP/IP network protocol suite and a UDP/IP network protocol suite. 

40. The system of claim 39, wherein the one or more protocols includes an IPv4 network 
protocol 

41. The system of claim 39, wherein the one or more protocols includes an IPv6 network 
protocol. 

42. The system of claim 28, wherein the data packet uses one or more of a layer 2 protocol, a 
layer 3 protocol, and a layer 4 protocol. 

43. The system of claim 42, wherein the layer 2 protocol is selected from the group 
consisting of ATM and frame relay. 

44. The system of claim 42, wherein the layer 3 protocol is MPLS. 

45. The system of claim 28, wherein the packet processing information lacks information that 
supports stateful processing. 

46. The system of claim 28, wherein the packet processing information includes information 
that supports stateful processing. 

47. The system of claim 28, wherein the packet processing information consists essentially of 
information that supports stateless processing. 

48. The system of claim 28, further comprising: 

a first access control list associated with a first customer, the data packet received from the 
first customer; and 
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a second access control list associated with a second customer, the first access control list and 
the second access control list to manage network access to a shared firewall application. 

49. A system to manage delivery of a network service, the system comprising: 
means for receiving a data packet having a service address and a payload; 

means for identifying a plurality of network applications based at least in part on the service 
address, the plurality of network applications including at least a first network 
application, a second network application, and a third network application; 

means for distributing at least the payload of the data packet to the first network application 
and the second network application based at least in part on the service address; 

means for sequentially processing the data packet through at least the second network 

application and the third network application based at least in part on the service address; 
and 

means for sending a data packet service response based at least in part on the data packet 
sequential processing. 

50. The system of claim 49, wherein the means for sequentially processing the data packet 
through at least the second network application and the third network application includes means 
for statelessly sequentially processing the data packet through at least the second network 
application and the third network application. 

51. The system of claim 49, wherein: 

the means for receiving a data packet having a service address and a payload includes means 
for receiving the data packet via a first network interface; 
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the means for distributing at least the payload of the data packet to the first network 
application and the second network application includes means for distributing at least 
the payload of the data packet to the first network application and the second network 
application via a second network interface, the second network interface being different 
from the first network interface; 

the means for sequentially processing the data packet through at least the second network 
application and the third network application includes means for sequentially processing 
the data packet through at least the second network application and the third network 
application via the second network interface and one or more additional network 
interfaces, the one or more additional network interfaces being different from the first 
network interface and the second network interface; and 

the means for sending a data packet service response includes means for sending the data 
packet service response via the first network interface. 

52. The system of claim 51, wherein: 

the means for receiving a data packet includes means for receiving a data packet including a 
service port identifier; 

the means for distributing at least the payload of the data packet to the first network 
application and the second network application based at least in part on the service 
address includes means for distributing at least the payload of the data packet to the first 
network application and the second network application based at least in part on the 
service address and the service port identifier; and 
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the means for sequentially processing the data packet through at least the second network 
application and the third network application based at least in part on the service address 
includes means for sequentially processing the data packet through at least the second 
network application and the third network application based at least in part on the service 
address and the service port identifier. 

53. A method to manage delivery of a network service, the method comprising: 

a step for receiving a data packet having a service address and a payload; 

a step for identifying a plurality of network applications based at least in part on the service 

address, the plurality of network applications including at least a first network 

application, a second network application, and a third network application; 
a step for distributing at least the payload of the data packet to the first network application 

and the second network application based at least in part on the service address; 
a step for sequentially processing the data packet through at least the second network 

application and the third network application based at least in part on the service address; 

and 

a step for sending a data packet service response based at least in part on the data packet 
sequential processing. 
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54. The method of claim 53 ? wherein the step for sequentially processing the data packet 
through at least the second network application and the third network application includes a step 
for statelessly sequentially processing the data packet through at least the second network 
application and the third network application. 

55. The method of claim 53, wherein: 

the step for receiving a data packet having a service address and a payload includes a step for 
receiving the data packet via a first network interface; 

the step for distributing at least the payload of the data packet to the first network application 
and the second network application includes a step for distributing at least the payload of 
the data packet to the first network application and the second network application via a 
second network interface, the second network interface being different from the first 
network interface; 

the step for sequentially processing the data packet through at least the second network 
application and the third network application includes a step for sequentially processing 
the data packet through at least the second network application and the third network 
application via the second network interface and one or more additional network 
interfaces, the one or more additional network interfaces being different from the first 
network interface and the second network interface; and 

the step for sending a data packet service response includes a step for sending the data packet 
service response via the first network interface. 
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56. The method of claim 55, wherein: 

the step for receiving a data packet includes a step for receiving a data packet including a 
service port identifier; 

the step for distributing at least the payload of the data packet to the first network application 
and the second network application based at least in part on the service address includes a 
step for distributing at least the payload of the data packet to the first network application 
and the second network application based at least in part on the service address and the 
service port identifier; and 

the step for sequentially processing the data packet through at least the second network 
application and the third network application based at least in part on the service address 
includes a step for sequentially processing the data packet through at least the second 
network application and the third network application based at least in part on the service 
address and the service port identifier. 

57. The method of claim 56, wherein the step for sending a data packet service response 
based at least in part on the data packet sequential processing includes a step for generating the 
data packet service response as a data product based at least in part on the data packet sequential 
processing. 

58. A computer-readable medium storing a plurality of instructions to be executed by a 
processor to manage delivery of data to a plurality of network applications, the plurality of 
instructions comprising instructions to: 

receive a data packet having a service address and a payload; 
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identify a plurality of network applications based at least in part on the service address, the 

plurality of network applications including at least a first network application, a second 

network application, and a third network application; 
distribute at least the payload of the data packet to the first network application and the 

second network application based at least in part on the service address; 
sequentially process the data packet through at least the second network application and the 

third network application based at least in part on the service address; and 
send a data packet service response based at least in part on the data packet sequential 

processing. 

59. The computer-readable medium of claim 58, wherein the instructions to sequentially 
process the data packet through at least the second network application and the third network 
application include instructions to statelessly sequentially process the data packet through at least 
the second network application and the third network application. 

60. The computer-readable medium of claim 58, wherein: 

the instructions to receive a data packet having a service address and a payload include 
instructions to receive the data packet via a first network interface; 

the instructions to distribute at least the payload of the data packet to the first network 
application and the second network application include instructions to distribute at least 
the payload of the data packet to the first network application and the second network 
application via a second network interface, the second network interface being different 
from the first network interface; 
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the instructions to sequentially process the data packet through at least the second network 
application and the third network application include instructions to sequentially process 
the data packet through at least the second network application and the third network 
application via the second network interface and one or more additional network 
interfaces, the one or more additional network interfaces being different from the first 
network interface and the second network interface; and 

the instructions to send a data packet service response include instructions to send the data 
packet service response via the first network interface. 

61. The computer-readable medium of claim 60, wherein: 

the instructions to receive a data packet include instructions to receive a data packet 
including a service port identifier; 

the instructions to distribute at least the payload of the data packet to the first network 
application and the second network application based at least in part on the service 
address include instructions to distribute at least the payload of the data packet to the first 
network application and the second network application based at least in part on the 
service address and the service port identifier; and 

the instructions to sequentially process the data packet through at least the second network 
application and the third network application based at least in part on the service address 
include instructions to sequentially process the data packet through at least the second 
network application and the third network application based at least in part on the service 
address and the service port identifier. 
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62. A method of delivering data to a plurality of network applications, the method 
comprising: 

receiving a first data packet, the first data packet including a first service address and a first 
data packet payload; 

identifying a first plurality of network applications associated with the first service address, 
the first plurality of network applications associated with the first service address 
including a first network application, a second network application, and a third network 
application; 

sending at least the first data packet payload to the first network application; 
sending at least the first data packet payload to the second network application; 
receiving a second network application response packet from the second network application; 
sending a third network application packet to the third network application, the third network 

application packet based at least in part on the second network application response 

packet; 

receiving a second data packet, the second data packet including a second service address 

and a second data packet payload; 
identifying a second plurality of network applications associated with the second service 

address, the second plurality of network applications associated with the second service 

address including a fourth network application, a fifth network application, and a sixth 

network application; 
sending at least the second data packet payload to the fourth network application; 
sending at least the second data packet payload to the fifth network application; 
receiving a fifth network application response packet from the fifth network application; and 
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sending a sixth network application packet to the sixth network application, the sixth network 
application packet based at least in part on the fifth network application response packet. 

63. The method of claim 62, wherein: 

receiving a first data packet includes receiving the first data packet at an Internet service 
provider; and 

receiving a second data packet includes receiving the second data packet at an Internet 
service provider. 

64. The method of claim 62, wherein at least one network application of the first plurality of 
network applications and the second plurality of network applications includes a passive real- 
time intrusion detection application. 

65. The method of claim 62, wherein at least one network application of the first plurality of 
network applications includes a remote network application. 

66. The method of claim 65, wherein the remote network application is an Internet network 
application. 

67. The method of claim 62, wherein: 

the first data packet is received from a first customer; and 

the second data packet is received from a second customer, the first customer being different 
from the second customer. 
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68. The method of claim 67, wherein the first network application and the fourth network 
application are the same network application. 

69. The method of claim 67, wherein the second network application and the fifth network 
application are the same network application. 

70. The method of claim 67, further comprising: 

receiving a first service management instruction from the first customer; 

modifying a first service data record corresponding to the first service address based at least 

in part on the first service management instruction; 
receiving a second service management instruction from the second customer; and 
modifying a second service data record corresponding to the second service address based at 

least in part on the second service management instruction. 

71 . The method of claim 62, further comprising determining an addition of a redundant 
network application, the redundant network application being the same as one or more network 
applications of the first plurality of network applications. 

72. The method of claim 71, further comprising: 

detecting a failed network application of the first plurality of network applications; and 
directing a third data packet to the redundant network application based at least in part on 
detecting the failed network application. 

73. A system to manage delivery of one or more network services, the system comprising: 
a first packeting engine, the first packeting engine including 

first means for receiving a data packet having a service address and a payload, 
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first means for identifying a plurality of network applications based at least in part 
on the service address, the plurality of network applications including at least 
a first network application, a second network application, and a third network 
application, 

first means for distributing at least the payload of the data packet to the first 

network application and the second network application based at least in part 

on the service address, 
first means for sequentially processing the data packet through at least the second 

network application and the third network application based at least in part on 

the service address, and 
first means for sending a data packet service response based at least in part on the 

data packet sequential processing. 
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74. The system of claim 73, wherein the data packet includes a service port identifier. 

75. The system of claim 74, wherein the first packeting engine includes means for service 
port translation. 

76. The system of claim 75, wherein the means for service port translation contains means 
for packeting engine service port translation. 

77. The system of claim 74, wherein one or more of the first network application, the second 
network application, and the third network application include means for application service port 
negotiation. 

78. The system of claim 74, wherein one or more of the first network application, the second 
network application^ and the third network application include means for application service 
address negotiation. 

79. The system of claim 73, wherein the first packeting engine includes means for tracking 
packet progress. 

80. The system of claim 73, wherein the first network application and the second network 
application are different vendor implementations of a network application. 

8 1 . The system of claim 73, wherein the first packeting engine performs TCP stateless load 
balancing of a plurality of service addresses to multiple applications. 

82. The system of claim 73, wherein the first packeting engine performs TCP stateless load 
balancing of the service address to multiple applications. 

83. The system of claim 73, further comprising: 
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a second packeting engine, the second packeting engine coupled to the first packeting engine, 
the second packeting engine including 

a second means for receiving the data packet having the service address and the 
payload, 

a second means for identifying the plurality of network applications based at least 

in part on the service address, the plurality of network applications including 

at least the first network application, the second network application, and the 

third network application, 
a second means for distributing at least the payload of the data packet to the first 

network application and the second network application based at least in part 

on the service address, 
a second means for sequentially processing the data packet through at least the 

second network application and the third network application based at least in 

part on the service address, and 
a second means for sending the data packet service response based at least in part 

on the data packet sequential processing. 
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84. The system of claim 83, wherein the first packeting engine and the second packeting 
engine are stateless, redundant packeting engines. 

85. The system of claim 83, further comprising means for load sharing between the first 
packeting engine and the second packeting engine. 

86. The system of claim 83, wherein the first packeting engine is to handle inbound traffic 
and the second packeting engine is to handle outbound traffic. 

87. The system of claim 83, wherein the first packeting engine and the second packeting 
engine perform TCP stateless load balancing for the service address. 

88. The system of claim 83, wherein the first packeting engine and the second packeting 
engine are part of an network service provider system. 
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